Security Engineer

• Join PostHog’s Security team as an expert security generalist, working fully remotely from the UK or Europe. • Take the reins of security operations and build detection pipelines from scratch. • Lead incident response, from compromised packages to suspicious IAM activity. • Build internal security products and agents that triage alerts and review pull requests. • Shape security culture at a fast-growing open-source company with zero bureaucracy. • Enable engineers to build safely rather than saying no.

• Bring 3–5+ years of security engineering experience with a heavy focus on AWS. • Know IAM, VPC flow logs and CloudTrail inside out. • Show experience with CSPM or CNAPP tools such as Wiz or Prisma. • Build detection pipelines that engineers trust. • Show experience leading incident response calmly across teams. • Write code with the same proficiency as product engineers. • Work with high autonomy and decide what matters without a manual. • Enable engineers with a collaborative “here’s how to do this safely” attitude. • Work within GMT to GMT+2 time zones.

• Bring experience writing Semgrep rules or building secure libraries. • Show experience running a vulnerability disclosure or bug bounty programme. • Bring experience building AI agents for security automation. • Show interest in corporate security and CI/CD supply chain hardening.

• Own Wiz alerts and turn noise into actionable findings. • Lead security incident detection and response, including post-mortems and runbooks. • Build detection pipelines and close network observability gaps. • Proactively hunt for threats in the AWS environment. • Triage reports through the Vulnerability Disclosure Program and help move to bug bounty. • Support product teams with threat modelling and secure design reviews. • Help build a security culture where engineers see security as an enabler.

We have used PostHog's web analytics ourselves and genuinely loved the experience. The product is fast, thoughtfully designed, and surprisingly fun to use. PostHog is unlike most SaaS companies: their entire handbook is public, their codebase is open source, and they share revenue figures and board meeting notes with every team member. The company has raised $194M from investors, including Stripe, GV, and Y Combinator, reached a $1.4 billion valuation in 2025, and is targeting $100M in ARR by the end of 2026. They pay generously, benchmarking engineering salaries at the 90th percentile of San Francisco rates adjusted by location, with a fully public compensation calculator so you know your salary before you even apply. Employees on Glassdoor consistently highlight the flexible spending, genuine remote-first culture, and regular offsites, alongside a $1,500 quarterly budget for meeting up with colleagues anywhere in the world. Many team members are former founders, and the company is structured around small, autonomous teams that own their products end-to-end. If you are an engineer or builder who thrives on autonomy, ships fast, and wants to work on a product used by nearly 200,000 teams, PostHog is a rare opportunity.

• Earn generous, transparent compensation plus significant equity. • Work fully remotely in an async-first, natively remote company. • Take unlimited vacation, with a minimum. • Enjoy two meeting-free days a week. • Get a home office budget, coworking credit and a training budget. • Receive private health, dental and vision insurance and pension contributions. • Join company offsites and access the Hedge House.

PostHog is your product’s context layer, ingesting and storing analytics, errors, replays and business data so teams and their agents can query and act on it. It launched from Y Combinator’s W20 cohort and has shipped more than a dozen products, installed by over 500,000 organisations. PostHog has raised more than $180 million and is default alive, growing quickly and efficiently.